Binance Starts Reimbursing Users After $6.34 Billion Hack, Freezes $3 Billion in Crypto

Binance says it has begun returning assets to users affected by the October 29 attack and has set aside more than $6.34 billion of its own funds to cover losses. For PSPs and risk teams, the important part is simple: this is not just an exchange incident, it is a liquidity, custody, and reimbursement event at very large scale.

1. Binance said it allocated more than $6.34 billion from its own funds to compensate users hit by the breach. About $5 billion of that is already held by the exchange in the same tokens that were affected, while the rest is being bought on the open market and through OTC (over-the-counter) deals.
2. The company said the replacement process may take time because some cryptocurrencies have limited liquidity. That matters in practice: even when a venue can cover losses on paper, reimbursement speed can depend on how quickly it can source the same assets without distorting the market.
3. Binance also said that, together with partners, it froze about $3 billion in crypto. Those assets are not included in the $6.34 billion reserve because they still need to be returned after additional checks.
4. The exchange said it will continue covering confirmed losses from its own balance sheet. It also plans to verify the safety of customer funds through Proof of Reserves, its public reserve-attestation system.
5. The possible hack became public on the evening of October 29, when funds started moving from Binance wallets across nine blockchain networks, including Bitcoin, Ethereum and Solana, to addresses controlled by a single attacker. Experts estimated the damage at about $6.3 billion, which would make it the largest crypto theft in history if confirmed.

TRM Labs suspects North Korean hackers were behind the attack, and says the same group was previously suspected of stealing about $1.5 billion from Bybit. Binance said it is conducting its own investigation and that the attackers may have gained access through a compromised laptop belonging to a DevOps engineer.